feat: display configured keyboard shortcuts inside tray menubar dropdown menu (#1854) by Samarth1306w · Pull Request #2091 · CapSoftware/Cap

Samarth1306w · 2026-08-06T05:23:12Z

Summary

Display configured hotkeys next to menu item actions inside the desktop tray menubar dropdown menu and refresh the menu dynamically when shortcuts are modified in Settings.

****:
- Added helper on .
- Added helper to query active keybindings from the .
- Wired inside so tray menu item labels/accelerators update immediately upon saving a new hotkey.
****:
- Passed into for Record Display, Record Window, Record Area, and Take Screenshot items.

Greptile Summary

The PR adds tray-menu accelerator labels with dynamic refresh, introduces a CLI command and web endpoint for AI video metadata, adds rate limiting to selected endpoints, supports configurable OpenAI-compatible URLs, and adjusts desktop/mobile teleprompter layout behavior.

Displays configured recording and screenshot shortcuts in the desktop tray menu.
Adds cap recordings info and a corresponding video-metadata GET endpoint.
Adds endpoint rate limits and a contract test for rate-limit identifiers.
Preserves teleprompter position across selected relayouts and supports OPENAI_BASE_URL.

Confidence Score: 2/5

This PR is not safe to merge until the password-protected metadata disclosure and valid share-URL parsing failure are fixed.

The new metadata route exposes AI-derived content without enforcing the existing password gate, while the CLI rejects valid copied share URLs containing common trailing or query components; the remaining comments are non-blocking repository-quality issues.

Files Needing Attention: apps/web/app/api/video/metadata/route.ts, apps/cli/src/recordings.rs

Security Review

The new metadata endpoint bypasses the password gate for public password-protected videos, exposing titles, summaries, chapters, and generation status to unauthenticated callers. How this was verified: The added GET handler returns metadata whenever video.public is true and contains no password-cookie or shared video-policy validation.

Important Files Changed

Filename	Overview
apps/desktop/src-tauri/src/hotkeys.rs	Adds accelerator formatting and queues a tray refresh after hotkey changes; no blocking defect remains in the checked lock path.
apps/desktop/src-tauri/src/tray.rs	Attaches configured hotkey accelerators to recording and screenshot tray items.
apps/cli/src/recordings.rs	Adds remote metadata retrieval, but valid copied URLs with common suffixes are parsed into invalid video IDs.
apps/web/app/api/video/metadata/route.ts	Adds metadata retrieval but bypasses password protection for public videos and introduces an unsafe any cast.
apps/web/tests/unit/rate-limit-ids.test.ts	Adds a repository-wide rate-limit-ID reference check with redundant comments contrary to repository guidance.
apps/mobile/src/recording/TeleprompterOverlay.tsx	Preserves normalized playback progress across subsequent text layouts; current callers prevent editing during playback.
packages/env/server.ts	Adds optional validated configuration for an OpenAI-compatible base URL.

Prompt To Fix All With AI

### Issue 1
apps/web/app/api/video/metadata/route.ts:61-63
**Password gate bypassed for metadata**

When an unauthenticated caller supplies the ID of a public, password-protected video, this check grants access based only on `video.public`, exposing its AI title, summary, chapters, and generation status without the configured password. **How this was verified:** The successful GET path contains no password-cookie or shared video-policy check before returning the metadata.

### Issue 2
apps/cli/src/recordings.rs:111-119
**Share URL suffix corrupts ID**

When a copied share URL contains a trailing slash, query string, or fragment, `rsplit('/')` produces an empty or decorated video ID, causing valid URLs such as `https://cap.so/s/abc123/` or `https://cap.so/s/abc123?t=30` to fail with a 404.

### Issue 3
apps/web/app/api/video/metadata/route.ts:65
**Metadata cast discards type safety**

Casting persisted metadata to `Record<string, any>` removes type checking from every returned property, allowing incompatible values and misspelled fields to pass compilation. Use `unknown` with narrowing or an existing metadata type instead.

### Issue 4
apps/web/__tests__/unit/rate-limit-ids.test.ts:6-7
**Allowlist comments duplicate the code**

These comments only narrate the adjacent, self-describing `UNWIRED_RATE_LIMIT_IDS` declaration and add text that must be maintained without preserving a non-obvious invariant or trade-off.

```suggestion

```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat: display configured keyboard shortc..." | Re-trigger Greptile}

Greptile also left 4 inline comments on this PR.

Context used (6)

Context used - CLAUDE.md (source)
Knowledge Base — Desktop Tauri App (Rust Backend)
Knowledge Base — Cap CLI (apps/cli)
Knowledge Base — Web App (apps/web)
Knowledge Base — Mobile App (apps/mobile)
Knowledge Base — Infra, Storage and Config

…ack endpoints and add contract test (CapSoftware#2039)

…ontract test

…pSoftware#2081)

…tware#2015)

…e LLM endpoints (CapSoftware#1996)

…own menu (CapSoftware#1854)

superagent-security · 2026-08-06T05:23:19Z

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

greptile-apps · 2026-08-06T05:26:23Z

+		return Response.json({ error: "Unauthorized" }, { status: 401 });
+	}
+


Password gate bypassed for metadata

When an unauthenticated caller supplies the ID of a public, password-protected video, this check grants access based only on video.public, exposing its AI title, summary, chapters, and generation status without the configured password. How this was verified: The successful GET path contains no password-cookie or shared video-policy check before returning the metadata.

Knowledge Base Used: Web App (apps/web)

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/web/app/api/video/metadata/route.ts Line: 61-63 Comment: **Password gate bypassed for metadata** When an unauthenticated caller supplies the ID of a public, password-protected video, this check grants access based only on `video.public`, exposing its AI title, summary, chapters, and generation status without the configured password. **How this was verified:** The successful GET path contains no password-cookie or shared video-policy check before returning the metadata. **Knowledge Base Used:** [Web App (apps/web)](https://app.greptile.com/cap/-/custom-context/knowledge-base/capsoftware/cap/-/docs/web-app.md) --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-08-06T05:26:24Z

+    let video_id = if url_or_id.contains('/') {
+        url_or_id
+            .rsplit('/')
+            .next()
+            .unwrap_or(&url_or_id)
+            .to_string()
+    } else {
+        url_or_id
+    };


Share URL suffix corrupts ID

When a copied share URL contains a trailing slash, query string, or fragment, rsplit('/') produces an empty or decorated video ID, causing valid URLs such as https://cap.so/s/abc123/ or https://cap.so/s/abc123?t=30 to fail with a 404.

Knowledge Base Used: Cap CLI (apps/cli)

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/cli/src/recordings.rs Line: 111-119 Comment: **Share URL suffix corrupts ID** When a copied share URL contains a trailing slash, query string, or fragment, `rsplit('/')` produces an empty or decorated video ID, causing valid URLs such as `https://cap.so/s/abc123/` or `https://cap.so/s/abc123?t=30` to fail with a 404. **Knowledge Base Used:** [Cap CLI (`apps/cli`)](https://app.greptile.com/cap/-/custom-context/knowledge-base/capsoftware/cap/-/docs/cli.md) --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-08-06T05:26:24Z

+	}
+
+	const meta = (video.metadata as Record<string, any>) ?? {};
+


Metadata cast discards type safety

Casting persisted metadata to Record<string, any> removes type checking from every returned property, allowing incompatible values and misspelled fields to pass compilation. Use unknown with narrowing or an existing metadata type instead.

Context Used: CLAUDE.md (source)

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/web/app/api/video/metadata/route.ts Line: 65 Comment: **Metadata cast discards type safety** Casting persisted metadata to `Record<string, any>` removes type checking from every returned property, allowing incompatible values and misspelled fields to pass compilation. Use `unknown` with narrowing or an existing metadata type instead. **Context Used:** CLAUDE.md ([source](https://github.com/capsoftware/cap/blob/main/CLAUDE.md)) --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

greptile-apps · 2026-08-06T05:26:24Z

+// Rate limit IDs declared in advance for firewall rules or separate app packages
+// that are intentionally not yet wired in apps/web endpoints.


Allowlist comments duplicate the code

These comments only narrate the adjacent, self-describing UNWIRED_RATE_LIMIT_IDS declaration and add text that must be maintained without preserving a non-obvious invariant or trade-off.

Suggested change

// Rate limit IDs declared in advance for firewall rules or separate app packages

// that are intentionally not yet wired in apps/web endpoints.

Context Used: CLAUDE.md (source)

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/web/__tests__/unit/rate-limit-ids.test.ts Line: 6-7 Comment: **Allowlist comments duplicate the code** These comments only narrate the adjacent, self-describing `UNWIRED_RATE_LIMIT_IDS` declaration and add text that must be maintained without preserving a non-obvious invariant or trade-off. ```suggestion ``` **Context Used:** CLAUDE.md ([source](https://github.com/capsoftware/cap/blob/main/CLAUDE.md)) --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

SamarthNimangre and others added 7 commits August 4, 2026 00:41

fix(security): wire RATE_LIMIT_IDS to guest-checkout and analytics/tr…

07a82ac

…ack endpoints and add contract test (CapSoftware#2039)

test(security): exempt reserved unwired rate limit IDs in reference c…

7e94c28

…ontract test

test: exclude test file self-references from rate limit contract scanner

59b69c5

fix: preserve teleprompter scroll position when resuming playback (Ca…

e186c9f

…pSoftware#2081)

feat(cli): fetch AI summaries and video info from share links (CapSof…

d745ba9

…tware#2015)

feat: support custom OPENAI_BASE_URL for self-hosted OpenAI-compatibl…

b19720b

…e LLM endpoints (CapSoftware#1996)

feat: display configured keyboard shortcuts inside tray menubar dropd…

7d9427b

…own menu (CapSoftware#1854)

greptile-apps Bot reviewed Aug 6, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat: display configured keyboard shortcuts inside tray menubar dropdown menu (#1854) - #2091

feat: display configured keyboard shortcuts inside tray menubar dropdown menu (#1854)#2091
Samarth1306w wants to merge 7 commits into
CapSoftware:mainfrom
Samarth1306w:feat/display-keyboard-shortcuts-in-tray-menu-1854

Samarth1306w commented Aug 6, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

superagent-security Bot commented Aug 6, 2026

Uh oh!

greptile-apps Bot Aug 6, 2026

Uh oh!

greptile-apps Bot Aug 6, 2026

Uh oh!

greptile-apps Bot Aug 6, 2026

Uh oh!

greptile-apps Bot Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		return Response.json({ error: "Unauthorized" }, { status: 401 });
		}

		}

		const meta = (video.metadata as Record<string, any>) ?? {};

		// Rate limit IDs declared in advance for firewall rules or separate app packages
		// that are intentionally not yet wired in apps/web endpoints.

Uh oh!

Conversation

Samarth1306w commented Aug 6, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Greptile Summary

Confidence Score: 2/5

Security Review

Important Files Changed

Context used (6)

Uh oh!

superagent-security Bot commented Aug 6, 2026

Uh oh!

greptile-apps Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Samarth1306w commented Aug 6, 2026 •

edited by greptile-apps Bot

Loading